vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-22 08:51:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): classify proxied APNs TLS tunnel (#110480)

Browse Source 
* fix(ci): classify proxied APNs TLS tunnel

* fix(ci): prove network CodeQL contract changes

Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
xingzhou
2026-07-18 23:18:29 +08:00
committed by GitHub
parent 63a32e360b
commit faf3dbdda8
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql vendored
View File

@@ -62,13 +62,10 @@ predicate allowedRawSocketClientCall(Expr call) {
or
allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal")
or
allowedOwnerScope(call, "src/infra/gateway-lock.ts", "checkPortFree")
or
allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes")
or
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "connectToProxy")
or
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "startTargetTls")
// This TLS layer wraps the managed CONNECT socket; it cannot open a direct route.
allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openApnsTlsTunnel")
or
allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session")
or